Menu
CoddyCyber
Start learning

Review the Boundary

Part of the Stopping the Spread section of Coddy's Cybersecurity journey. Lesson 19 of 20.

After an incident, review whether a new service is reachable by more people than it needs to be. Check the approved business purpose before changing access.

Inspect the practice server’s services and firewall:

seclab machine demo-shop

Look for these lines:

demo-shop: demo-shop, owner maya, zone servers
services:
service  port  version  status      open from
admin    22    1        up to date  internet, office, servers, retail, payments, storage
https    443   1        up to date  internet, office, servers, retail, payments, storage

Suppose its approved policy allows internet customers to use HTTPS, while office support uses administration. Block only internet access to administration:

seclab firewall demo-shop deny 22 internet at 1

You should see:

Added rule 1 on demo-shop: deny 22 from internet. Rules are checked top down.

Inspect the services again:

seclab machine demo-shop

Look for these lines:

services:
service  port  version  status      open from
admin    22    1        up to date  office, servers, retail, payments, storage
https    443   1        up to date  internet, office, servers, retail, payments, storage

Internet is no longer listed for the administration service, while HTTPS remains available. A useful boundary protects the private service without preventing the public service from doing its job.

challenge icon

Challenge

Easy

Ticket from Sam, IT lead

A new supplier-portal was added after the incident. Its approved policy allows internet users to reach HTTPS and office support to reach administration. Review its initial rules and remove internet administration access. Keep both approved uses available and leave checkout working.

Try it yourself

Terminal

All lessons in Stopping the Spread

1Trace the Connection

Follow a ConnectionTest a RouteFollow the Whole OrderInside the CompanyOrders Without Payment

4Recover and Verify

Prove the BlockRecover in StagesReport the ImpactReview the BoundaryLumen Stays Open

2Close the Unwanted Route

Destination RulesRule OrderOutbound RulesAllow the Needed WorkTwo Unwanted Routes

3Contain More Than One Computer

Isolate a ComputerThe Exposed PasswordFollow the SpreadKeep Customers WorkingTwo Active Computers